Why is my Windows PC ignoring 802.1X on an Ethernet cable?

Because Windows doesn't run the Wired AutoConfig service by default. Without it, a PC never responds to 802.1X on a wired port, even if it's enrolled and connects to Wi-Fi fine.

It looks just like a broken certificate: no IP address, nothing in Passbeam's authentication log for that PC, and eventually the switch puts the port on its fallback VLAN. Nothing reached Passbeam, so there was nothing to refuse.

The service is called Wired AutoConfig, or dot3svc. It needs to be running and set to start automatically. If it's running but set to Manual, it works until the next restart and then stops, which can look like a cable fault weeks later.

Passbeam's Intune step handles this in two parts. A platform script, under Devices, Scripts and remediations, Platform scripts, sets the service to Automatic, starts it and checks it before reporting success. Separately, an Intune configuration profile under Templates, Wired network has the 802.1X settings, including which certificate the device should use.

The script doesn't touch any network profile, so the two can't conflict and the order they arrive in doesn't matter.